topic Re: Splunk field-extraction strangeness. in Splunk Search

Splunk field-extraction strangeness.

Splunker — Sun, 01 Jan 2012 03:35:57 GMT

Folks,

Running Splunk 4.2.4 in a distributed setup (1 SH + 1 Indexer).

In the Splunk for Cisco Firewall TA is defined the following in the apps transforms.conf:

[ciscosyslog-action-allowed] REGEX = (Built|[pP]ermitted) FORMAT = action::allowed actual_action::$1

Running the following search sourcetype=cisco_asa actual_action=Built works OK.

However, running sourcetype=cisco_asa action=allowed returns no results.

The transform is running, permissions are global read/write (set by the app), and i can see the 'action' field in the field picker, with the value "allowed" in it, but when it's added to the search it returns no results?

Also clicking on the value in the field picker returns no results.

Anyone have any ideas to try? (i've run out...) 🙂

Thanks.

Re: Splunk field-extraction strangeness.

Ayn — Mon, 02 Jan 2012 07:15:30 GMT

This sounds very much like the situation described in this blog post: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Re: Splunk field-extraction strangeness.

Splunker — Mon, 02 Jan 2012 09:30:02 GMT

Thank you Ayn! That was most definitely the issue which is now resolved 🙂

I will also submit this as a bug in the Cisco Firewall TA app (amongst a few others).

Re: Splunk field-extraction strangeness.

andrew_garvin — Mon, 25 Feb 2013 06:03:27 GMT

I am having the exact same issue. Can you please post the fix here so others can use it?

Re: Splunk field-extraction strangeness.

woodcock — Sat, 02 May 2015 13:46:15 GMT

The fix is to add to fields.conf this:



[action]

INDEXED_VALUE = false